CALL US! 941-493-5126
This HUGE And Recent Data Breach Practically Guarantees YOUR Personal Information Was Stolen
This HUGE And Recent Data Breach Practically Guarantees YOUR Personal Information Was Stolen
In May, the company MOVEit, a file transfer platform made by Progress Software, was compromised by a Russian ransomware operation called Cl0p. They used a vulnerability in Progress’s software that was unknown then. Shortly after the attack was noticed, a patch was issued. However, some users continued to be attacked because they didn’t install it.
The software is used by thousands of governments and financial institutions and hundreds of other public and private companies from around the world, and it’s been estimated that at least 455 organizations and over 23 MILLION individuals who were customers of MOVEit have had their information stolen.
Some of the organizations compromised include:
- The US Department of Energy
- New York City Department of Education
- UCLA
- Shell
- Ernst & Young
- Northwest Mutual
- Pacific Premier Bank
- TransAmerica Life Insurance
- Honeywell
- Bristol Myers Squibb
- Gen/Norton LifeLock
- Radisson Hotel
- BBC
- British Airways
Most of those organizations (73%) are based in the US, while the rest are international, with the most heavily impacted sectors being finance, professional services, and educational institutions.
Cl0p is a type of ransomware used in cyber-attacks since 2019. Data stolen is published to a site on the dark web – a section of the World Wide Web where cybercriminals sell and trade information without revealing themselves. The ransomware and website have been linked to FIN11. This financially motivated cybercrime operation has been connected to Russia and Ukraine and is believed to be part of a more extensive umbrella operation known as TA505.
What makes this attack so terrible is that many compromised organizations provide services to many other companies and government entities, which means it’s very likely their customers, patients, taxpayers, and students were compromised by association. And yes, you’re probably one of them.
The big question is, were you notified?
For some reason, this breach didn’t make mainstream headlines, but when a company is compromised, it must tell you if your data was stolen. This can come in the form of an e-mail or snail mail letter. However, due to spam filters, e-mail delivery is not a reliable way to ensure an important message is received. Organizing a letter for over 36 million people can take time.
If you use the software, you must ensure that all your passwords and PINs are changed ASAP and be on the lookout for any strange activity. Please don’t use the same passwords, and make sure they are at least 12 characters long, using uppercase and lowercase letters and special characters and numbers.
You should also ensure that MFA, or multifactor authentication, is turned on for all critical software applications and websites you use, such as Microsoft Office, QuickBooks, banking and payroll software, your credit card processor, etc.
Want to know if your company’s information is on the dark web? Click here to request a free Vulnerability Scan for your organization (sorry, we don’t offer this for individuals). Let us know your domain name, and we’ll conduct the search for free and contact you to discuss what was found via a confidential review (NOT via e-mail). Questions? Call us at 941-493-5126.
